Loading story…
SonicWall experienced a significant security incident in early October 2025, resulting in the unauthorized access of firewall configuration backup files for all customers utilizing the MySonicWall cloud backup service. The breach exposed sensitive configuration data, including device settings, encrypted credentials, VPN configurations, private keys, and administrator information. Although the credentials and secrets were protected with AES-256 encryption, the exposure of this data raised substantial concerns about the potential for further exploitation, especially in cases where weak or reused passwords were present. Forensic analysis conducted by SonicWall in collaboration with Mandiant confirmed that 100% of cloud backup customers were affected, making this a global event with far-reaching implications for network security.
Following the breach, security researchers, including those at Huntress, observed a marked increase in SonicWall SSLVPN account compromises starting on October 4, 2025. Over 100 accounts across 16 customer environments were breached, with attackers using valid credentials rather than brute-force methods. The malicious activity was traced to a single IP address (202.155.8[.]73), and attackers were seen rapidly authenticating, conducting network scans, and attempting lateral movement within affected environments. In some cases, attackers disconnected quickly, but in others, they pursued deeper access by targeting local Windows accounts.
Evidence suggests that the Akira ransomware group may be leveraging both the stolen credentials and known SSLVPN vulnerabilities to facilitate these intrusions. While Huntress did not find direct evidence linking the observed SSLVPN compromises to the configuration file breach, the timing and nature of the attacks have raised concerns about a possible connection. The exposed configuration files, even though encrypted, could potentially be decoded by determined attackers, revealing authentication passwords and keys in their encrypted form. This scenario underscores the risk posed by the breach, particularly if attackers are able to crack or otherwise obtain the necessary decryption keys.
SonicWall and security vendors have issued urgent guidance to affected customers, recommending immediate review of the MySonicWall portal for impact assessment and the implementation of enhanced security measures. System administrators are advised to follow SonicWall’s security checklist, which includes steps such as resetting credentials, reviewing access logs, and applying any available patches or mitigations. The incident has prompted widespread concern within the security community due to the scale of the exposure and the potential for further exploitation.
The breach highlights the critical importance of strong encryption, robust credential management, and rapid incident response in cloud-based security services. It also demonstrates the potential for configuration data leaks to serve as a springboard for targeted attacks, including ransomware campaigns. Organizations using SonicWall products are urged to remain vigilant, monitor for signs of compromise, and coordinate closely with SonicWall and their security partners to mitigate ongoing risks. The incident serves as a stark reminder of the evolving threat landscape facing managed security service providers and their customers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting said a SonicWall cloud backup breach exposed customer network data or access, suggesting the impact extended beyond individual VPN account compromises. This appears to be an escalation in understanding of the scope affecting customers.
Attackers used previously stolen credentials in a broad campaign targeting SonicWall VPN accounts, leading to unauthorized access to customer environments. Reporting indicates the activity was widespread rather than limited to a single victim.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have launched a widespread campaign targeting SonicWall SSL VPN devices, resulting in the compromise of over 100 accounts across at least 16 customer environments. Security firm Huntress reported that attackers are rapidly authenticating into multiple accounts on compromised devices, indicating possession of valid credentials rather than relying on brute-force methods. The campaign began in earnest around October 4, 2025, with authentication attempts traced to a specific IP address, 202.155.8[.]73. In some cases, attackers disconnected after brief access, but in others, they conducted network scanning and attempted to access local Windows accounts, suggesting a range of post-compromise activities. The incident follows SonicWall’s disclosure of a security breach involving unauthorized exposure of firewall configuration backup files stored in MySonicWall accounts, which could provide attackers with sensitive information such as user and group settings, DNS configurations, and certificates. Although there is no direct evidence linking the configuration file breach to the VPN compromises, the risk of credential exposure remains high, prompting advisories for organizations to reset credentials on live firewall devices. Concurrently, security teams observed a surge in Akira ransomware incidents exploiting SonicWall SSL VPN devices, initially suspected to be due to a zero-day but later attributed to the known vulnerability CVE-2024-40766. This vulnerability, an improper access control flaw in SonicOS, affects multiple generations of SonicWall devices and was first disclosed and patched in August 2024. Despite the availability of a patch, unpatched devices remain vulnerable and have been actively targeted by Akira ransomware affiliates. In one documented case, Darktrace detected suspicious activity including network scanning, lateral movement, privilege escalation, and data exfiltration on a customer’s network, with approximately 2 GiB of data exfiltrated before the attack was contained. The attackers’ tactics included leveraging both the CVE-2024-40766 vulnerability and misconfigurations to gain access. The campaign underscores the importance of timely patching and credential hygiene, as attackers are exploiting both technical vulnerabilities and exposed credentials to infiltrate networks. Organizations using SonicWall’s cloud backup service are particularly at risk if they have not reset credentials following the configuration file exposure. Security advisories recommend immediate credential resets and patching of all affected SonicWall devices to mitigate ongoing threats. The incidents highlight the persistent threat posed by ransomware groups like Akira, who continue to exploit both new and previously disclosed vulnerabilities in widely deployed network infrastructure. The rapid detection and response by managed security services, such as those provided by Darktrace, have proven effective in limiting the impact of these attacks. However, the scale and speed of the current campaign demonstrate the attackers’ ability to coordinate and execute widespread compromises across multiple organizations. The situation remains dynamic, with ongoing investigations into the full extent of the compromise and the potential links between credential exposure and active exploitation. Organizations are urged to review their SonicWall device configurations, monitor for suspicious authentication activity, and ensure all security patches are applied without delay.
Jun 29, 2026
Hackers gained unauthorized access to firewall configuration backup files stored in SonicWall’s MySonicWall cloud backup service, impacting all users of the platform. The breach was initially disclosed in September 2025, when SonicWall urged customers to reset credentials after discovering that backup files tied to MySonicWall accounts had been exposed. Although SonicWall’s initial advisory suggested that under 5% of customers were affected, subsequent investigation confirmed that all customers using the cloud backup service were impacted. The stolen configuration files contain sensitive information, including encrypted credentials, user and group settings, DNS and log settings, and certificates, which could be leveraged by threat actors to compromise organizational networks. Only Gen 7 and newer SonicWall firewalls encrypt credentials and secrets in exported configuration files using AES-256, leaving older devices more vulnerable to exploitation. SonicWall has blocked further unauthorized access and is collaborating with cybersecurity experts and law enforcement to assess the full scope of the incident. The company has notified affected customers and provided detailed instructions for identifying impacted devices and remediating the risk. Customers are advised to import new preference files, a process that disrupts IPSec VPNs, TOTP bindings, and user access, requiring reconfiguration of VPN pre-shared keys and reset of TOTP and user passwords. To minimize operational impact, SonicWall recommends performing these actions during maintenance windows or periods of low activity, as the process necessitates an immediate firewall reboot. Arctic Wolf notes that threat actors, including nation-state and ransomware groups, have previously exploited exfiltrated firewall configuration files in subsequent attacks. SonicWall has established a dedicated support team to assist organizations with remediation and has published an in-depth advisory with up-to-date guidance. Organizations are strongly urged to reset credentials on all affected firewalls and to follow SonicWall’s recommendations to prevent unauthorized access. The exposure of these configuration files represents a significant risk, as they can provide attackers with the information needed to bypass network defenses. The incident underscores the importance of robust encryption for sensitive configuration data and the need for rapid response to cloud service breaches. SonicWall continues to work with partners and customers to ensure all affected systems are secured and to prevent further exploitation of the stolen data.
Jun 29, 2026
SonicWall confirmed that a security breach in September resulted in unauthorized access to firewall configuration backup files stored in certain MySonicWall accounts. The company, with support from Mandiant, determined that the attack was carried out by a state-sponsored threat actor and was limited to a specific cloud environment accessed via an API call. The breach did not impact SonicWall products, firmware, source code, or customer networks, but exposed sensitive information such as access credentials and tokens, prompting SonicWall to advise customers to reset passwords and shared secrets for various services and interfaces. Following the incident, SonicWall notified all customers using its cloud backup service for firewall configurations and provided assessment tools to help identify affected devices. The company emphasized that the breach was unrelated to Akira ransomware or other ongoing attacks and has since implemented additional security measures based on Mandiant's recommendations. Law enforcement and external cybersecurity experts were engaged throughout the investigation, and SonicWall continues to strengthen its systems to prevent future incidents involving nation-state actors.
Jun 29, 2026